Privacy Policy

1. About This Policy

BRAND 360s ("BRAND 360s", "we", "us" or "our") is a one-stop business partner for startups, SMEs and enterprises across India, offering company registration (Start), compliance (Comply), IP and legal protection (Protect), branding and web (Build) and digital growth (Grow) services. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you visit our website or use our Services. By using the Website or submitting an enquiry, you acknowledge this policy; where the law requires consent, we ask for it separately.

For personal data that we determine the purposes and means of processing, BRAND 360s acts as a Data Fiduciary where the Digital Personal Data Protection Act, 2023 (DPDP Act) applies. When processing personal data solely on a client’s documented instructions, we generally act as a Data Processor. We comply with applicable Indian privacy and information-security law, including provisions of the DPDP Act and DPDP Rules, 2025 as and when they commence, and applicable provisions of the Information Technology Act, 2000 and related rules.

2. Information We Collect

3. Why We Use Your Information

We use personal data for specified, lawful purposes:

• To answer enquiries, prepare proposals and book consultations;
• To deliver the Services, including design, development, content, SEO, marketing and registration filings;
• To prepare, file and track applications with government departments and portals on your behalf;
• To raise invoices, process payments and keep accounting records;
• To send project updates, deadlines and renewal reminders;
• To send newsletters or offers where you have agreed or where otherwise permitted by applicable law, with an easy way to opt out;
• To measure and improve the Website, content and Services and to prevent fraud and security threats;
• To meet legal and tax obligations and to establish or defend legal claims.

Where the DPDP Act applies, we process personal data on the basis of valid consent or a specifically permitted legitimate use under that Act. Other applicable laws may independently require or permit certain recordkeeping and disclosures. Submitting a service enquiry does not by itself constitute consent to unrelated promotional messages.

We do not sell your personal data. We do not use solely automated decision-making to make decisions that have legal or similarly significant effects on you.

4. Who We Share It With

We do not sell or rent your personal data. We share it only where necessary and appropriate with:

• Our team and assigned professionals: employees, designers, developers, marketers and associated Chartered Accountants, Company Secretaries or advocates, subject to confidentiality duties.
• Government and regulatory bodies: relevant authorities and portals (for example MCA, GST, Customs/ICEGATE or DGFT) for requested filings.
• Service providers: website hosting, email, CRM, cloud storage, form and booking, communications, analytics and payment processing providers used by us, subject to appropriate contractual and security controls.
• Advertising and social platforms: where campaigns or website tracking are used, subject to applicable consent and disclosure requirements.
• Professional advisers: lawyers, auditors and insurers, where reasonably necessary.
• Authorities: where disclosure is required by law or court order.
• A successor business: in a merger, acquisition or restructuring, subject to applicable safeguards and notice requirements.

5. Where Your Data Is Stored

Some of our tools and providers (including cloud storage, email, analytics and communication services) may process data outside India. Cross-border transfers are subject to applicable Indian law, including any restrictions notified under the DPDP Act, and reasonable contractual and technical safeguards. Contact us to enquire about the locations and providers relevant to your data.

6. Payments

We accept invoice-based payments, including bank transfers and UPI, and may use third-party payment processors where offered. Payment credentials entered directly into a bank or payment provider’s systems are processed by that provider, not by BRAND 360s. We retain invoice details, transaction references, amounts, dates and payment status for accounting and compliance. Do not share your UPI PIN, CVV or net-banking password with us.

7. Data We Handle for Clients

For services such as social media management, email marketing, website development, SEO, advertising and lead generation, we may handle personal data of our clients’ customers, followers or leads. Where the client determines the purposes and means of processing, the client acts as Data Fiduciary and we process the data on its documented instructions, subject to applicable law and our agreement. If you are a client’s customer and have a privacy request, contact that client directly; you may also contact us so we can route your request.

If you share other people’s personal data with us (for example directors, partners, employees or customers), you must have the necessary authority and provide applicable notices or obtain consent where required.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the stated purposes, to meet legal obligations or to address legitimate disputes, applying the following indicative periods subject to applicable law and documented retention schedules:

• Enquiries and leads with no engagement: ordinarily up to 24 months after the last meaningful interaction, unless consent is withdrawn earlier or retention is otherwise required.
• Client project files and communications: during the engagement and ordinarily up to 3 years afterwards, unless a longer statutory or contractual period applies.
• Invoices, payment and accounting records: for the applicable statutory retention period, which may extend to 8 years or longer depending on the record and law.
• Registration documents and filing records: for the applicable statutory period and any continuing compliance engagement; not all records have the same retention requirement.
• Marketing subscribers: until consent is withdrawn, the subscription ends, or the data is no longer required.
• Analytics data: according to the actual configuration and retention settings of the relevant analytics provider.

After the relevant retention period, we delete, de-identify or securely archive information as appropriate. Deletion requests remain subject to lawful retention duties, and backup copies may be removed on normal backup cycles.

9. Your Rights

Subject to the applicable law and commencement of relevant provisions, you may request information about personal data processed, correction or updating, erasure where applicable, withdrawal of consent, grievance redressal and nomination of another individual to exercise rights in specified circumstances.

Send requests to founder@brand360s.co with the subject “Privacy Request”. We may verify your identity before acting and will respond within the period required by applicable law. Withdrawing consent does not invalidate earlier lawful processing and may affect services dependent on that consent. You may unsubscribe from promotional email using the available opt-out method.

10. Security

We use reasonable technical and organisational safeguards appropriate to the information processed, including access controls, HTTPS/TLS for the Website where configured, restricted access to client files, confidentiality requirements and security practices for service providers. We seek to use multifactor authentication on supported sensitive accounts and to review access periodically; the exact controls depend on the systems in use.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will investigate and provide notices to affected persons and authorities as required by applicable law.

11. Children, Links and Communications

• Children: our Website and Services are directed to businesses and adults. We do not knowingly solicit personal data from persons under 18. If a minor’s data is necessary for a lawful client service, we will address applicable parental consent and other legal requirements.
• Third-party links: the Website may link to or embed content from third parties, such as social media, maps, videos, client portfolios or government portals. Their privacy practices are governed by their own policies.
• Communications: if you contact us by WhatsApp, phone or email, we may reply on the same channel. Promotional communications are sent only as permitted by applicable law, with available opt-out options.
• Cookies and similar technologies: our Website may use essential cookies and, if enabled, analytics or advertising technologies. Where required, we will provide a choice before activating non-essential tracking. Browser settings may also allow you to restrict cookies.

12. Changes to This Policy

We may update this policy as our Services, tools or the law change. The “Last updated” date shows the current version. For significant changes, we will provide notice on the Website or through another appropriate channel.

13. Grievance Officer and Contact

For privacy concerns and grievances, contact the BRAND 360s Privacy and Grievance Desk at founder@brand360s.co (subject: “Privacy Grievance”). We will acknowledge and address complaints through our internal process within applicable legal timelines. Where law requires publication of a named grievance officer or additional contact details, those details must be added before the relevant requirement takes effect.